#Denial of Service
All CosmicBytez Labs articles tagged #Denial of Service, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-115339: Progress WS_FTP Server Unauthenticated Denial of Service
Insufficient resource limits in WS_FTP Server on Windows let an unauthenticated remote attacker trigger denial of service (CVSS 7.5). Upgrade to 2025.0.5.
- News
Android 'SMS of Death' Exploit Can Remotely Crash Unpatched Phones
A public PoC for CVE-2026-58882 lets a crafted WAP Push text crash phones or disrupt cellular service. Android 12 and 13 remain unpatched.
- News
Cisco ASA and FTD SSL VPN Zero-Day (CVE-2026-76418) Exploited to Crash Firewalls
Cisco patched CVE-2026-76418, an exploited ASA/FTD SSL VPN flaw that lets attackers force firewalls to reload — the second such zero-day since August.
- News
New QPACK Flaws Can Crash HTTP/3 Servers With Up to 4,000-Fold Memory Amplification
FoxIO found header-decompression flaws in 7 of 10 tested HTTP/3 stacks. One unauthenticated connection can exhaust server memory. PoC code is public.
- Security
CVE-2026-73790: HPE NonStop iTP WebServer Input Validation Flaw Enables Remote Crash
Unauthenticated, network-exploitable input validation bug in HPE NonStop iTP WebServer can corrupt memory and shut down the system.
- Security
CVE-2026-14854: Unauthenticated Memory-Exhaustion DoS in WooCommerce Bookings
WooCommerce Bookings before 3.11.0 lets unauthenticated attackers exhaust server memory with a single unbounded AJAX request.
- Security
CVE-2015-5477: Decade-Old ISC BIND TKEY Flaw Added to CISA's KEV Catalog
A 2015 reachable-assertion DoS bug in ISC BIND's TKEY handling hit CISA's KEV catalog Oct. 8, 2026 after Flax Typhoon exploitation; patch by Oct. 11.
- News
One Packet, No Password: High-Severity TDengine Zero-Day Threatens Industrial Servers
A high-severity zero-day, CVE-2026-42542, crashes TDengine time-series database servers with one packet — 730,000+ instances run in OT, IoT, and energy.
- Security
Unauthenticated Denial-of-Service in Apache Qpid Broker-J ≤ 10.1.0
A pre-auth denial-of-service flaw (CVSS 7.5) in Apache Qpid Broker-J lets attackers crash the AMQP broker via malformed frame headers.
- News
New Windows Defender Zero-Day Blocks Microsoft Antivirus Updates
Researcher Abdelhamid Naceri released BigDiskBuster, a zero-day that freezes Windows Defender signature and platform updates indefinitely.
- Security
CVE-2026-94083 & CVE-2026-94084: Suricata DoH2/HTTP2 Flaws Let Attackers Crash IDS/IPS
Suricata 8.0.7 fixes two CVSS 9.4 unauthenticated crash bugs in its DoH2 and HTTP/2 parsers that can blind network monitoring. Upgrade now.
- News
ISC Patches 14 Vulnerabilities in BIND 9 DNS Server Software
ISC fixes 14 BIND 9 flaws, including 7 high-severity bugs that can crash named, exhaust memory, or poison DNS caches. No active exploitation reported.
- Security
CVE-2026-13260: IBM Verify Identity Access Remote Denial-of-Service Flaw
IBM Verify Identity Access lets a remote, unauthenticated attacker exhaust resources and cause denial of service via unvalidated requests.
- Security
CVE-2026-59682: OpenRGB Arbitrary File Overwrite via SAVE_PROFILE
OpenRGB's network protocol lets remote attackers overwrite (and delete) arbitrary files through the SAVE_PROFILE message, up to v1.0rc3.
- News
Cisco Warns of ASA and FTD VPN Flaw Actively Exploited to Crash Firewalls
CVE-2026-20349 (CVSS 8.6) in Cisco ASA and FTD allows unauthenticated remote attackers to crash SSL VPN devices via crafted HTTP requests — no workaround...
- Security
CVE-2026-20349: Cisco ASA and FTD Heap Inspection Vulnerability
Cisco Secure Firewall ASA and FTD contain a heap inspection vulnerability allowing unauthenticated remote attackers to crash devices and trigger a denial...
- Security
CVE-2026-35547: FreeBSD libnv Heap Buffer Overflow Allows
A critical heap buffer overflow in FreeBSD's libnv library allows an unprivileged program to write outside heap allocation bounds during message header...
- Security
CVE-2026-26477: DokuWiki media_upload_xhr() Denial of Service
A high-severity denial-of-service vulnerability in DokuWiki v.2025-05-14b 'Librarian' allows remote attackers to crash the application by exploiting the...
- Security
CVE-2018-25169: Denial of Service Vulnerability Catalogued
A denial of service vulnerability in AMPPS 2.7, a local web server stack for developers, has been formally assigned CVE-2018-25169 with a CVSS score of...